If your team signs in to Microsoft 365 from Android phones, check the Microsoft Authenticator app today. Microsoft has fixed CVE-2026-80097, a flaw that could let a malicious app on the same phone get sign-in tokens for a work account. The fix is in Authenticator for Android build 6.2606.4246.
What the flaw is
Microsoft's advisory describes it as an elevation of privilege vulnerability caused by improper authentication in Microsoft Authenticator. On Android, Authenticator does more than show codes: it can also act as a broker that hands sign-in tokens to other Microsoft apps. Researchers at Enclave reported that a malicious app could pose as a trusted Microsoft app such as Teams and collect those tokens. A token is a digital pass that proves a user is signed in.
Key facts from the sources:
| Item | Detail |
|---|---|
| CVE | CVE-2026-80097 |
| Product | Microsoft Authenticator for Android |
| Affected | 6.0.0 up to (not including) 6.2606.4246 (NVD) |
| Fixed in | 6.2606.4246 |
| Severity | Important, CVSS 8.6 (Microsoft) |
| Microsoft published | 8 September 2026 (revised 15 September to correct the fix build number) |
| Exploited? | Microsoft says no; publicly disclosed before fix: no; exploitation less likely |
The researcher is credited as Ofek Levin of Enclave. Enclave published technical details on 23 October 2026, according to The Hacker News.
How worried should you be?
Microsoft says exploitation needs a malicious app installed on the device and a user completing an authentication flow in Authenticator. The Hacker News reports that Enclave's tests returned tokens without any user interaction beyond a signed-in account, so the two accounts differ on that point. We would not rely on the lower-risk reading. In Enclave's tests the tokens reached email, files and calendar, which is the core of most small business accounts.
The practical lesson is simple: a phone is part of your security perimeter. Do not install apps from unknown sources on phones that hold work accounts. Our mobile app security checklist and the Apple iPhone update alert cover the same habit.
What to do
- List who uses Authenticator on Android. Include owners, managers and contractors who access Microsoft 365 from personal phones.
- Update the app from the Google Play Store to build 6.2606.4246 or later. You can see the version in the app's information screen on Android.
- Require the minimum version if your IT partner uses device management for Android phones.
- Remove apps you do not recognise from phones that sign in to work accounts, and stop installing apps from outside the official store.
- Review recent sign-in activity in your Microsoft 365 admin tools for anything unfamiliar.
- Ask your IT partner about signing sessions out. Microsoft's advisory does not say whether updating cancels a token an app may already have obtained, per The Hacker News, so forcing a fresh sign-in is a sensible precaution (this is our suggestion, not Microsoft's guidance).
- Keep two-factor authentication on for every account.
Where we can help
We build and maintain websites and apps for small businesses in India and the US, and we help owners set simple update and device rules. Read our website maintenance guide for a routine that covers patches, or contact us if you want a second pair of eyes on your setup.
Sources
- Microsoft Security Response Center: CVE-2026-80097, Microsoft Authenticator Elevation of Privilege Vulnerability
- NVD: CVE-2026-80097
- The Hacker News: Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens (27 October 2026)
- CISA: Known Exploited Vulnerabilities catalog
